Threat video1:00
Kimsuky APT43 Dot-Padded LNK Phishing: Detection & IOCs
Kimsuky's dot-padded LNK lures run hidden PowerShell and MSHTA; 9 detection rules, 20 IOCs, 17 ATT&CK techniques and a free Splunk SPL rule map it.
Read the full threat intel for Kimsuky APT43 Dot-Padded LNK Phishing: Detection & IOCs →
Chapters
- 0:00The hookKimsuky's full attack chain decoded.
- 0:04The storyFake PDF lure triggers execution.
- 0:10Attack pathLNK lure starts execution.
- 0:23AttributionAttributed to Kimsuky.
- 0:28Indicators of compromise18 indicators to hunt: 3 URLs, 4 SHA-256 hashes and 3 MD5 hashes, and more.
- 0:38MITRE ATT&CK techniques17 ATT&CK techniques, from initial access to defense impairment.
- 0:43Remediation6 steps now: Isolate affected host.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Kimsuky's full attack chain decoded.
0:05Fake PDF lure triggers execution.
0:08Hidden admin ensures persistence.
0:11LNK lure starts execution.
0:13PowerShell runs through proxies.
0:15Service and tasks persist.
0:17Admin accounts created and activated.
0:20Security log cleared.
0:24Attributed to Kimsuky. Confidence: high.
0:2818 indicators to hunt: 3 URLs, 4 SHA-256 hashes and 3 MD5 hashes, and more.
0:3817 ATT&CK techniques, from initial access to defense impairment.
0:446 steps now: Isolate affected host.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.